The example debezium-openshift is Vulnerability to XSS

[808Mak1r]

Description

Registry Version: latest
Persistence type:

Environment

Steps to Reproduce

1. The code path is https://github.com/Apicurio/apicurio-registry/blob/7439fd5ef88761399e3e68049ba08488d463a908/examples/debezium-openshift/src/ main/java/io/apicurio/example/debezium/rest/Api.java#L23-L23 The command at L23-L23 is user controlled.
2. The code path is https://github.com/Apicurio/apicurio-registry/blob/7439fd5ef88761399e3e68049ba08488d463a908/examples/debezium-openshift/src/ main/java/io/apicurio/example/debezium/rest/Api.java#L33-L33 where the user-controllable commands are directly spliced and returned without processing.

    @POST
    @Path("/command")
    public String command(String command) {
        log.info("Command received: {}", command);
        switch (command) {
            case "start":
                runner.setEnabled(true);
                return "OK";
            case "stop":
                runner.setEnabled(false);
                return "OK";
            default:
                return "Unknown command: " + command;
        }
    }
}

The potential problem here is the command parameter, which can cause XSS attacks if this parameter contains malicious JavaScript code and the API's response content is rendered directly in the HTML page without proper escaping or filtering. For example, if the value of the command parameter is “<script>alert(‘XSS’)</script>” and the returned Unknown command: <script>alert('XSS')</script> is inserted directly into the HTML, the browser will execute this script.

Fix

To ensure the security of your code, you can escape user input before returning it. Here is an example of escaping using the Apache Commons Text library:

import org.apache.commons.text.StringEscapeUtils;

public String command(String command) {
    log.info("Command received: {}", command);
    switch (command) {
        case "start":
            runner.setEnabled(true);
            return "OK";
        case "stop":
            runner.setEnabled(false);
            return "OK";
        default:
            return "Unknown command: " + StringEscapeUtils.escapeHtml4(command);
    }
}

This approach escapes special characters in user input as HTML entities, preventing the execution of malicious scripts on HTML pages.
Additionally, it is highly recommended to take precautions on both the front-end and back-end, including:

• Validating and cleaning input on the back-end.
• Encoding output on the front-end.
• Use security policies such as CSP.

Expected vs Actual Behaviour

Logs

[carlesarnal]

As it's own name says, this is just an example, so opening a vulnerability issue about it does not seems reasonable. As a result, I'm closing this.